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SPECIFICATION 

Portable Point Storing Member and 
Method of Using the Same 

Technical Field 

The present invention relates to a portable point storing member and 
a method of using the same, and particularly a point storing member 
having improved secrecy and a method of using the same. 



Background Art 

It has been proposed to employ a data communication system using 
J IC cards in ticket barriers of a ski lift and a railroad, an automatic cargo 

S sorting system and others. 

U 15 Fig. 12 shows a data communication system using IC cards, and 

* p articularly a structure of a communication system using non-contact IC 

3 cards. This system is formed of an interrogator 40 (e.g., mounted in a gate 

1 of a ski lift) and a non-contact IC card 100. 

3 Interrogator 40 is controlled by a controller 48 to issue a high- 

3 20 frequency carrier wave generated by an oscillator circuit (OSC) 49 from an 
antenna 41. When non-contact IC card 100 approaches interrogator 40, an 
antenna 23 of non-contact IC card 100 receives this high-frequency carrier 
wave. A power producing circuit 25 converts the received high-frequency 
wave into a DC power, and supplies it to other circuit portions. Thereby, 
25 non-contact IC card 100 can start the operation when it approaches 
interrogator 40. 

Information transmission from interrogator 40 to non-contact IC card 
100 is performed by modulating the above high-frequency carrier wave by a 
modulator-demodulator circuit 46. A controller 35 performs necessary 
30 processing such as change of contents of a memory 37 and return of 
information based on the demodulated information. 

Information is also transmitted from non-contact IC card 100 to 
interrogator 40. Since an oscillator circuit is not employed in non-contact 
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IC card 100, the information is sent in the following manner. Interrogator 
40 issues non-modulated high-frequency carrier wave, and modulator- 
demodulator circuit 33 in non-contact IC card 100 changes an impedance of 
resonance circuit 22. Interrogator 40 handles this impedance change as 
the impedance change of resonance circuit 42 on its own side, and 
modulator-demodulator circuit 46 detects and demodulates it. Controller 
48 obtains the demodulated information, and performs necessary 
processing. 

When non-contact IC card 100 moves away from interrogator 40, the 
power supply is interrupted so that non-contact IC card 100 stops the 
operation. Since memory 37 is a nonvolatile memory, the stored 
information is held even when the power supply is interrupted. 

Memory 37 in non-contact IC card 100 described above may store 
predetermined points, and the data in memory 37 may be changed in 
accordance with the used points, whereby the IC card can be used as a 
prepaid card. 

Data is communicated in an encrypted form between the interrogator 
and the IC card. Thereby, it is possible to prevent unauthorized change of 
the contents in the IC card which was once used. 

However, the communication system using the IC cards in the prior 
art suffers from the following problems. Although the communication data 
is encrypted as described above, the data can be altered if the encryption 
algorithm is interpreted. Therefore, it is difficult to ensure the secrecy of 
the system only by the encryption. 

In particular, if the interrogator is located in a place open to the 
public, and particularly, in a public telephone or the like, the telephone set 
internally provided with the interrogator may be stolen. When stolen, 
instructions and commands to be sent between the interrogator and the IC 
card may be analyzed. 

An object of the invention is to overcome the above problems, and 
particularly to provide a portable point storing member, which can 
suppress illegal use, as well as a method of using the same. 



Disclosure of the Invention 

For achieving the above object, an aspect of the invention provides a 
portable point storing member for storing points corresponding to moneys, 
including changing means for reading the stored points in accordance with 
5 an externally applied read instruction, and changing the stored points in 
accordance with an externally applied point changing instruction, wherein 
change of the points in a direction of increasing the points is inhibited by a 

circuit structure. 

According to the invention, the data change which increases the 
10 points can be reliably prevented. Thereby, it is possible to provide the 
point storing member, of which illegal use is difficult. 

Preferably, the portable point storing member further includes point 
rewrite information storing means for storing, in advance, point rewrite 
information, wherein the circuit structure is switched to allow change of the 
15 points in the direction of increasing the points when applied information 
matches with the point rewrite information. 

According to the invention, the point change which increases the 
points can be prevented only when it is necessary. 

According to another aspect, a portable point storing member 
20 includes point storing means storing points corresponding to moneys, and 
having data holding portions equal in number to the points for holding 
write data, read means for reading out the points stored in the point storing 
means in accordance with an externally applied read instruction, and point 
changing means allowing change of each of the data holding portions in the 
25 point storing means only from a first state to a second state in accordance 
with an externally applied point changing instruction. 

According to the above aspect, since the data holding portions can be 
changed only from the first state to the second state, illegal data change 
can be reliably prevented. 
30 More preferably, the portable point storing member further includes 

point rewrite information storing means for storing point rewrite 
information, and collating means for collating applied information with the 
point rewrite information. The point changing means can change each of 



the data holding portions from the first state to the second state, and can 
also change each of the data holding portions from the second state to the 
first state in accordance with a result of collation by the collating means. 

According to the invention, each data holding portion can be changed 
from the second state to the first state only when the applied information 
corresponds to the point rewrite information which is already stored. 
Thereby, illegal data change can be reliably prevented. 

According to still another aspect of the invention, a method of using a 
portable point storing member includes the steps of storing, in advance, 
points corresponding to moneys in the point storing member having 
portability; reading the points stored in the point storing member in 
accordance with an externally applied read instruction; and changing the 
points in accordance with an externally applied point changing instruction, 
wherein changing of the points in a direction of increasing the points is 
inhibited by a circuit structure. 

Further preferably, in the method of using the portable point storing 
member, the point storing member stores, in advance, point rewrite 
information, and the circuit structure is switched to allow the point change 
in the direction of increasing the points when applied information matches 
with the point rewrite information. 

According to yet another aspect, a method of using a portable point 
storing member includes the steps of storing points corresponding to 
moneys in the point storing member having portability; reading the points 
stored in the point storing member in accordance with an externally 
applied read instruction; and changing the points in accordance with an 
externally applied point changing instruction, wherein the point storing 
means has data holding portions corresponding in number to the points, 
each of the data holding portions is allowed to change only from a first state 
to a second state, and the point storing member stores the points in 
accordance with the states of the respective data holding portions. 

More preferably, in the method of using the portable point storing 
member, the point storing member stores, in advance, point rewrite 
information, and each of the data holding portions can be changed from the 
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first state to the second state, and can also be changed from the second 

state to the first state when applied information matches with the point 

rewrite information. 

According to further another aspect of the invention, a point storing 
5 member includes storing means for storing the points, changing means for 

changing the points stored in the storing means, and inhibiting means for 

inhibiting increase of the points by the changing means. 

Further preferably, the point storing member includes input means 

for receiving data to be verified, and comparing means for comparing the 
10 received data with a predetermined cryptogram. The inhibiting means 

inhibits increasing of the points in accordance with a result of the 

comparison by the comparing means. 

Brief Description of the Drawings 
15 Fig. 1 shows functional blocks in a point storing member 1 of an 

embodiment of the invention; 

Fig. 2 schematically shows a structure of an IC card 10 of an 
embodiment of the invention; 

Fig. 3 shows a memory 50 and a controller 60 in Fig. 2 in greater 

20 detail; 

Fig. 4 schematically shows a structure of memory 50; 

Fig. 5 shows, by way of example, voltages for reading, writing, 
erasing and disabling; 

Fig. 6 shows relationships between a read change circuit 61, a 
25 cryptogram collating portion 63 and a memory area selection detecting 
circuit 67; 

Fig. 7 shows a cryptogram collating portion 63 in greater detail; 
Fig. 8 is a flow chart showing operation of IC card 10; 
Fig. 9 is a flow chart following Fig. 8; 
30 Fig. 10 is a flow chart following Fig. 9; 

Fig. 1 1 is a flow chart following Fig. 8; and 

Fig. 12 is a block diagram showing structures of IC card 100 and 
interrogator 40 in the prior art. 
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Best Mode for Carrying Out the Invention 

The invention will be described in greater detail with reference to the 

accompanying drawings. 

[1. Function Blocks of IC Card] 

Referring to Fig. 1, description will now be given on a point storing 
member 1 of an embodiment of the invention. Point storing member 1 has 
portability, and includes a point storing portion 3, a read portion 5, a point 
changing portion 7, a point rewrite information storing portion 13 and a 
collating portion 11. 

Point storing portion 3 is a portion for storing points corresponding 
to moneys, and have data holding portions, which can hold write data and 
are equal in number to the points. Read portion 5 reads out the points 
stored in point storing portion 3 in accordance with a read instruction 
which is externally applied. Point changing portion 7 can change each 
data holding portion in point storing portion 3 from an unwritten state 
(first state), where the write data is not held, to a written state (second 
state), where the write data is held, based on an externally applied point 
change instruction. 

Point rewrite information storing portion 13 stores point rewrite 
information, i.e., information for point rewriting. CoUating portion 11 
collates the applied information with the above point rewrite information. 
Point changing portion 7 can change each data holding portion from the 
unwritten state to the written state, and further can change each data 
holding portion from the written state to the unwritten state based on a 
result of the collation by collating portion 11. 

Assuming that the data holding portions in the unwritten state 
correspond in number to remaining points, the data change which increases 
the points can be reliably prevented, and the points can be increased only 
when such information is applied that matches with the point rewrite 
information which has been stored in advance. 
[2. Specific Structure of IC Card] 

A non-contact IC card employing the invention will now be described 



with reference to Fig. 2. 

Non-contact IC card 10 has a whole structure similar to that in the 
prior art, and includes an antenna 23, a resonance circuit 22, a power 
producing circuit 25, a modulator-demodulator circuit 33, a controller 60 
and a memory 50 which are arranged within a casing 11. The manner of 
arranging these portions and parts in casing 11 as well as manners of 
power supply and data transmission are the same as those in the prior art, 
and therefore will not be discussed below. 

Fig. 3 is a block diagram specifically showing controller 60 and 
memory portion 50 shown in Fig. 2. Memory 50 has a point area 51, a 
setting information area 52, a secret information area 53 and a secret data 
area 54. Point area 51 is an area for storing the points. Setting 
information area 52 is an area for storing setting information. Secret data 
area 53 is an area for storing a cryptogram of an IC card user. Secret data 
area 54 is an area for storing secret data of an IC card manufacturer. 

As shown in Fig. 3, point area 51 can store data of 128 bytes (1024 
bits). Setting information area 52 can store data of 32 bytes, secret data 
area 53 can store data of 3 bytes, and secret data area can store data of 3 
bytes. 

[2.1 Memory Portion 50] 

The memory structure of memory portion 50 will now be described 
with reference to Figs. 4 and 5. In this embodiment, an EEPROM is 
employed as the nonvolatile memory. Memory portion 50 is formed of cells 
Cll (see Fig. 4) arranged in a matrix form (not shown). 

For changing the data of ceU Cll (for performing the data writing by 
placing data "O" therein, and performing the data erasing by placing data 
"1" therein), and for reading out the data, voltages are applied to a bit line 
BL, a select line SL and a word line WL as shown in Fig. 5. 

For setting memory cell Cll to the written state (i.e., for keeping 
data "0" therein), a voltage of 20 V is applied to bit line BL, a voltage of 0 V 
is applied to select line SL and a voltage of 20 V is applied to word line WL 
so that a line AG is set to an open state. Thereby, electrons are injected 
into a floating gate of cell Cll so that cell 11 holds the data "0". 



For setting memory ceU Cll to the erased state (i.e., for keeping data 
"1" in memory cell Cll), voltages opposite to those for keeping the data "0" 
are applied. More specifically, 0 V is applied to bit line BL, 20 V is applied 
to select line SL and 20 V is applied to word line WL so that line AG is set 
5 to the open state (or 0 V)- Thereby, electrons are discharged from the 
floating gate of cell C 1 1 , and data " 1" is kept therein. 

For reading information from memory ceU Cll, a voltage of 5 V is 
applied to select line SL, a voltage of 5 V is applied to word line WL, and a 
sense amplifier (not shown) is connected to bit line BL. The result of 
10 detection by the sense amplifier changes depending on whether memory 

cell C 1 1 has stored "0" or " 1". Thereby, it is possible to determine whether 
memory ceU Cll has stored data "1" or data "0". 

As described above, each memory cell in point area 51 stores the data 
"0" or " 1", and each of the memory cells forms the data holding portion. 
15 Further, point area 51 has the memory cells equal in number to the points 
which were set in advance. For 1000 points, point area 5 1 has memory 
cells of 1000 bits. 

Setting information area 52, secret data area 53 and secret data area 
54 are configured to hold data of ordinary bit lengths, similarly to the prior 

20 art. 

[2.2 Controller 60] 

Controller 60 will now be described with reference to Fig. 3. 
Controller 60 has a main controller 69, an address decoder 65, a memory 
area selection detecting circuit 67, a cryptogram coUating portion 63 and a 

25 read change circuit 61. 

Main controller 69 designates an address based on the data applied 
from modulator-demodulator circuit 33, and applies the address to address 
decoder 65. Further, it applies an instruction for reading, writing or 
erasing to read change circuit 61. Further, main controller 69 applies a 

30 cryptogram to be collated to cryptogram coUating portion 6 3 . The address 
selected by address decoder 65 is detected by memory area selection 
detecting circuit 67, which applies the selected address to cryptogram 
collating portion 63 and read changing portion 61. 
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[2.2.1 Read Changing Circuit 61] 

Read change circuit 6 1 applies the read voltage, write voltage or 
erase voltage shown in Fig. 5 or a disabling voltage, which will be described 
later, to memory portion 50 in accordance with an instruction applied from 

5 main controller 69. 

Read change circuit 61 will now be described with reference to Fig. 6. 
Read change circuit 61 has selected address specifying terminals Tsl - Ts3, 
a mode terminal Te and a mode terminal Tf. Selected address specifying 
terminals Tsl - Ts3 are supplied with a signal, which specifies the selected 
10 area, from memory area selection detecting circuit 67. More specifically, 
when point area 51 is selected, a voltage "High" is applied to selected 
address specifying terminal Ts 1 . When setting information area 52 is 
selected, the voltage "High" is applied to selected address specifying 
terminal Ts2. When secret data area 53 is selected, the voltage "High" is 
15 applied to selected address specifying terminal Ts3. 

Mode terminals Te and Tf receive signals from cryptogram collating 
portion 63 . In this embodiment, read change circuit 6 1 selects one from 
the following three modes in accordance with the voltages applied to the 
two mode terminals. 
20 When both mode terminals Tf and Te are supplied with voltages 

"Low", a mode "0, 0" (normal mode) is selected. 

When mode terminals Tf and Te are supplied with voltages "Low" 
and "High", respectively, a mode "0, 1" (point rewriting mode) is selected. 
When mode terminals Tf and Te are supplied with voltages "High" 
25 and "Low", respectively, a mode "1, 0" (initializing mode) is selected. 

Read change circuit 61 applies the disabling voltage to each of the 
area in memory 50 in accordance with the voltages applied to selected 
address specifying terminals Tsl - Ts3 and mode terminals Te and Tf. 
In the respective modes, read change circuit 61 can apply the 
30 following voltages. In mode "0 , 0" , if the selected address which is 

specified by selected address specifying terminals Tsl - Ts3 is point area 51 
or setting information area 52, the write voltage shown in Fig. 5 can be 
issued. However, the erase voltage cannot be issued. 
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In mode "1, 0", if the selected address which is specified by selected 
address specifying terminals Ts 1 - Ts3 is point area 5 1 or setting 
information area 52, the write voltage and erase voltage shown in Fig. 5 
can be issued. However, if selected address specifying terminals Tsl - Ts3 

5 specify secret data areas 53 or 54, the write voltage or the erase voltage 

shown in Fig. 5 cannot be issued. Thus, the wilting and erasing shown in 
Fig. 5 can be performed only by point area 51 or setting information area 52. 

In mode "1, 0", if the selected address specified by selected address 
specifying terminals Tsl - Ts3 is point area 51, setting information area 52 

10 or secret data area 53, the erase voltage shown in Fig. 5 can be issued. 

However, if the selected address is secret data area 54, the erase voltage 
cannot be issued. The write voltage cannot be issued for any one of the 
areas. 

Data lines of secret data areas 53 and 54 axe connected to 

15 cryptogram collating portion 63 as shown in Fig. 3. Therefore, the 

cryptogram which is read out is not applied to main controller 69, and the 
cryptogram stored in secret data areas 53 and 54 can be prevented from 
being externally read out. 
[2.2.2 Cryptogram Collating Portion 63] 

20 Cryptogram collating portion 63 is enabled when it receives a 

detection signal from memory area selection detecting circuit 67, and 
thereby determines whether the cryptogram stored in secret data area 53 or 
54 matches with the signal applied from main controller 69. When they 
match with each other, voltage "High" is applied to mode terminals Te and 

25 Tf of read change circuit 6 1 . 

Cryptogram collating portion 63 will now be described in greater 
detail with reference to Fig. 7. Cryptogram collating portion 63 has 
comparators 71 and 73, and a data converting circuit 75. Comparator 73 
applies the voltage "High" to mode terminal Tf when it receives from main 

30 controller 69 the cryptogram which matches with a cryptogram of an IC 
card manufacturer stored in secret data area 54. 

Comparator 71 applies the voltage "High" to mode terminal Te when 
it receives from main controller 69 a cryptogram, which matches with a 
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cryptogram formed by coalescing the data applied from data converting 
circuit 75 with the data applied from secret data area 53. 

For example, when secret data area 54 has stored a cryptogram 
"10100000" and the IC card user has stored "1010" in secret data area 53 as 
5 his/her own cryptogram or pass word, the collation is performed as follows. 
Data converting circuit 75 converts the cryptogram "10100000" in secret 
data area 54. When the result of conversion is "0 10 1 1 1 1 1" , comp arator 7 1 
is supplied with a cryptogram "101001011111", which is a combination of 
the cryptogram "1010" of the IC card user stored in secret data area 53 and 

10 "01011111" following the cryptogram "1010". Comparator 71 determines 
whether the input data applied from main controller 69 for collation 
matches with the above cryptogram "101001011111" or not. 

Comparator 71 may be configured such that the cryptogram stored in 
secret data area 53 is compared with data obtained by removing the data 

15 sent from data converting circuit 75 from the data applied from main 
controller 69. 

In this embodiment, the IC card user is required to obtain the data, 
which is prepared by converting the cryptogram in secret data area 54 by 
data converting circuit 75, from the IC card manufacturer, and apply the 

20 same, as the cryptogram to be collated, to main controller 69 after adding 
thereto his/her own cryptogram. 

According to this embodiment, as described above, the cryptogram of 
secret data area 54 is converted a nd added to the cryptogram in secret data 
area 53 for comparison with the cryptogram data applied "from main 

25 controller 69 for collation. Accordingly, ffinUcarSmSrififacturer can ) 
store the cryptograms, which are different from each other and are 
dedicated to the IC card users, respectively, in secret data areas 53. 
Thereby, no confusion occurs even when two IC card users accidentally . 
stored the same cryptogram in secret data areas 53, respectively. Thus, 

30 one of the users cannot erase the data in the IC card oft he other usei\ ^ 

The specific comparator actually performing the collation is 
determined by a signal supplied from memory area selection detecting 
circuit 67. If the detected area is secret data area 54, the signal enabling 
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the collating operation is applied to comparator 73. If the detected area is 
secret data area 53, the signal enabling the collating operation is applied to 
comparators 71 and 73. 
[3. Processing in IC Card] 
5 Processing of reading, wilting and erasing the data as well as 

cryptogram collation will now be described with reference to Figs. 8 to 11. 
In the initial state (step ST1 which is not shown), mode terminals Te and Tf 
of read change circuit 61 are supplied with the voltages "Low", and the 
operation is in the mode "0, 0". 
10 Then, main controller 69 determines whether the instruction applied 

from modulator-demodulator circuit 33 is the read instruction, remaining 
point removing instruction, data changing instruction or initializing 
instruction (step ST3). 
[3.1 Read Operation] 
15 When the applied instruction is the read instruction, all the 

addresses in point area 5 1 are selected (step ST5). The read instruction is 
issued (step ST7). Thereby, all the data in point area 5 1 is read and 
applied to main controller 69 (step ST8). Main controller 69 counts and 
temporarily stores the bits (remaining points) holding data "1" in the 
20 applied data (step ST9). Then, all the addresses in setting information 
area 52 are selected (step ST1 1). Then, the read signal is issued to read 
change circuit 6 1 (step ST13). Thereby, the setting information stored in 
setting information area 52 is applied to main controller 69 (step ST14). 
Main controller 69 temporarily stores the applied setting information (step 
25 ST15). Main controller 69 issues the temporarily stored data to 
modulator-demodulator circuit 33 (step ST17). 

Thereby, it is possible to issue externally the remaining points stored 
in point area 51 as well as the setting information stored in setting 
information area 52. 
30 [3.2 Point Removing Processing] 

Description will now be given on the case where the instruction for 
removing the remaining points is applied in step ST3. In this case, main 
controller 69 reads out the remaining points which was temporarily stored 
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in step ST9 (step ST 19). The leading address of the memory cells in point 
area 5 1 holding data " 1" is selected (step ST2 1). Main controller 69 
applies the write signal (i.e., signal for holding data "0") to read change 
circuit 61 (step ST23). 
5 Read change circuit 61 which received the write signal determines 

whether the current state allows application of the wiite voltage or not, in 
accordance with the voltages applied to the select address specifying 
terminals and the mode terminals shown in Fig. 6. In this case, the 
selected address is point area 51, and the mode terminals were in the mode 
10 "0, 0" in step ST1 so that it is determined that the writing can be performed, 
and the write voltage shown in Fig. 5 is issued (step ST24). 

Then, main controller 69 decrements the remaining points which 
were temporarily stored in step ST9 (step ST25). Then, a message to the 
effect that the remaining point removing processing is completed is issued 
15 to modulator-demodulator circuit 33 (step ST27). When the instruction of 
removing the remaining points is issued, therefore, it is possible to change 
in the decrementing direction the points stored in point area 51 by a 
specified value. In this manner, the points which have been stored in 
point area 51 are read out, or the data can be changed in the direction of 
20 reducing the points in accordance with the point removing instruction. 
[3.3 Data Changing Processing] 

Description will now be given on the case where the data changing 
instruction is applied in step ST3. The data changing instruction is an 
instruction for changing the data in point area 51 or setting information 
25 area 52, and includes a collation instruction for collating the cryptogram 
stored in the secret data area. 

In this case, main controller 69 selects the addresses in secret data 
areas 53 and 54 (step ST5 1 in Fig. 9). Then, data to be verified is issued to 
cryptogram collating portion 63 (step ST53). Main controller 69 issues the 
30 read signal to read change circuit 6 1 (step ST55). Thereby, read change 
circuit 6 1 applies the read voltage (step ST56). Cryptogram collating 
portion 63 collates the cryptogram read from secret data areas 53 and 54 
with the verification target data applied from main controller 69 (step 
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ST57). 

More specifically, the cryptogram stored in secret data area 54 is 
applied to data converting circuit 75 (see Fig. 7). Data converting circuit 
75 converts this cryptogram based on a predetermined rile, and applies the 
5 result of conversion to comparator 71. Comparator 71 is also supplied 
with the cryptogram stored in secret data area 53. Comparator 71 
coalesces the data applied from data converting circuit 75 with the data 
applied from secret data area 53, and determines whether the resultant 
data matches with the applied verification target data. When matching 

10 occurs, comparator 71 applies the voltage "High" to mode terminal Te for 

read change circuit 61. Thereby, read change circuit 61 enters mode "0, 1" 
(step ST61 in Fig. 10). 

Main controller 69 selects all the addresses in point area 5 1 and 
setting information area 52 (step ST63). Then, it issues the erase signal to 

15 read change circuit 61 (step ST65). In this case, the erase voltage can be 
issued from read change circuit 61 because mode "0, 1" is selected, and the 
addresses in point area 51 and setting information area 52 are selected. 
Accordingly, read change circuit 61 applies the erase voltage (step ST66). 
When the erase voltage is applied, all the bits in point area 51 and setting 

20 information area 52 hold "1". 

Then, main controller 69 selects only the required bit(s) in point area 

51 and setting information area 52 (step ST67). For example, it is 
necessary to write the data and time of erasing in setting information area 

52 again. In this case, the bits holding data "0" are selected. 

25 Main controller 69 issues the write signal to read change circuit 61 

(step ST69). Read change circuit 61 applies the write voltage (step ST70). 
Thereby, only the selected bits hold the data "0". Main controller 69 
applies the end message to modulator-demodulator circuit 33 (step ST71). 
When the verification target data applied in step ST59 shown in Fig. 

30 9 causes mismatching, main controller 69 selects all the addresses in point 
area 51 and setting information area 52 (step ST73 in Fig. 10). Then, the 
erase signal is issued to read change circuit 61 (step ST75). Read change 
circuit 61 does not issue the erase voltage, but issues the disabling voltage 
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(step ST77) because the current mode is mode "0, 0". Accordingly, contents 
of point area 51 and setting information area 52 do not change. 

In the embodiment desciibed above, the disabling voltage is provided 
by placing the ground potential on line AG, and setting the other lines to 
the open state. 

Main controller 69 selects only the required bits in point area 51 and 
setting information area 52 (step ST79). Main controller 69 issues the 
write signal to read change circuit 6 1 (step ST 8 1). Since the current mode 
is "0, 0", and the selected address relates to point area 51 and setting 
information area 52, read change circuit 61 does not issue the write voltage, 
but issues the disabling voltage (step ST83). Accordingly, contents of point 
area 51 and setting information area 52 do not change. Main controller 69 
issues a message to the effect that rewriting could not be performed (step 
ST85). 

When the cryptogram-mismatching occurs, read change circuit 61 
does not apply the write voltage and the erase voltage even if main 
controller 69 issues the erase signal and the write signal to read change 
circuit 61. 

As described above, the data in point area 51 and setting information 
area 52 can be changed only when the applied cryptogram matches with 
the cryptogram data which has already been entered or applied by the IC 
card user and the IC card manufacturer. Accordingly, the IC card 
described above can have high secrecy. 
[3.4 Initializing Operation] 

Description will now be given on the case where the initializing 
instruction is issued in step ST3 shown in Fig. 8 with reference to Fig. 11. 
The initializing instruction acts to set all the data in point area 51, setting 
information area 52 and secret data area 53 other than secret data area 54 
to " 1", and is given from the IC card manufacturer. 

In this case, main controller 69 selects the address of Secret data area 
54 (step ST31), and issues verification target data to cryptogram collating 
portion 63 (step ST32). Main controller 69 issues the read signal to read 
change circuit 61 (step ST33). Read change circuit 61 applies the read 
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voltage (step ST34) . The cryptogram is collated in cryptogram, collating 
portion 63 (step ST35). In this case, comparator 73 is supplied with data 
stored in secret data area 54, and determines whether the verification 
target data applied from main controller 69 matches with the cryptogram 
stored in secret data area 54 or not (step ST36). 

When it is determined in step ST36 shown in Fig. 11 that the 
verification target data matches with the cryptogram, cryptogram collating 
portion 63 applies the voltage "High" to mode terminal Tf of read change 
circuit 61 (step ST37). Thereby, read change circuit 61 enters mode "1, 0". 

Then main controller 69 selects all the addresses in point area 51, 
setting information area 52 and secret data area 53 (step ST38). Further, 
it issues the erase signal to read change circuit 61 (step ST39). Since read 
change circuit 61 is in mode "1, 0", read change circuit 61 applies the erase 
voltage (step ST41). Thereby, all the data in point area 51, setting 
information area 52 and secret data area 53 are initialized. Main 
controller 69 issues the end message to modulator-demodulator 33 (step 
ST42). 

When mismatching occurs in the step ST36 shown in Fig. 11, the 
voltage "High" is not applied to mode terminal Tf of read change circuit 61. 
Accordingly, read change circuit 61 remains in mode "0, 0". Main 
controller 69 selects all the addresses in point area 51, setting information 
area 52 and secret data area 53 (step ST43). Further, it issues the erase 
signal to read change circuit 6 1 (step ST44). In this state, since read 
change circuit 61 is in the mode "0, 0", and the selected addresses relate to 
point area 51, setting information area 52 and secret data area 53. 
Therefore, read change circuit 61 applies the disabling voltage (step ST45). 
Thus, all the data in point area 51, setting information area 52 and secret 
data area 53 are not initialized. Main controller 69 issues a message to 
the effect that the initialization is impossible to modulator-demodulator 
circuit 33 (step ST46). 

As described above, the initialization can be performed only when 
the applied verification target data matches with the cryptogram stored in 
secret data area 54, even when the initializing instruction is issued. 
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[3.5 Cryptogram Storing Processing] 

In this embodiment, the IC card user stores the cryptogram or 
password in secret data area 53, and for this purpose, the data in secret 
data area 53 can be changed only one time after the data in secret data 

5 area 53 is initialized. When the data change instruction for changing the 
data in secret data area 53 is applied to main controller 69 after the 
initialization, main controller 69 allows the data change only one time so 
that the predetermined cryptogram can be stored in secret data area 53. 
More specifically, the above processing can be achieved through the steps 

10 from step ST61 to step ST70 in Fig. 10. 

Main controller 69 stores whether the data in secret data area 53 is 
already changed or not, and will ignore the instruction for changing the 
data in secret data area 53 when this instruction is issued again. 
[4. Other Embodiments] 

15 The embodiment described above relates to the non-contact IC card 

employing the invention. However, the invention can likewise to applied 

to contact IC card. 

Main controller 69 may form a CPU, or may be partially or entirely 
formed of a logic circuit. This is true also with respect to read change 
20 circuit 61, cryptogram collating portion 63, memory area selection detecting 
circuit 67 and others. 

According to the invention, point area 51 is provided with the 
memory cells corresponding in number to the intended points, as already 
described. In the mode "0, 0", the data change is allowed to change the 
25 memory cell of point area 5 1 only from the unwritten state holding the data 
" 1" to the written state not holding the write data " 1" . Thereby, forgery of 
the IC card can be prevented more reliably. 

An ordinary read-out device provides only the instruction, which 
changes the data in point area 51 only in the decrementing direction, for 
30 the IC card side. Therefore, damages caused by so-called "impersonation" 
can be prevented. 

The structure of memory 50 is not restricted to the foregoing, but 
may have such a structure that point area 51 and setting information area 
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52 are in one memory, and secret data areas 53 and 54 are formed in 
another memory. 

Secret data areas 53 and 54 for providing the cryptograms in two 
stages are not essential, and only one of them may be employed. 

The embodiment has been described in connection with the case 
where the EEPROM is used as memory portion 50. However, another 
structure may be used for memory portion 50 provided that its allows 
change of data, and a flash memory, a ferroelectric memory or the like may 
be used. 

Further, the present invention is similarly applicable to any storage 
other than these to which date is written electrically, for example, a storage 
to which date is written optically, provided that it allows switching between 
writing and erasure. 

In this embodiment, if mismatching is found as a result of collation 
by the cryptogram collating portion, each of mode terminals Te and Tf, 
which are input terminals of read change circuit 61 with respect to 
cryptogram collating portion 63, remains in "Low". Accordingly, read 
change circuit 61 merely applies the disabling voltage to memory portion 50, 
and there is no possibility that the data is forged. 

When the signal which acts to erase the data in point area 51 is 
applied, data "0" may be held in all the bits in point area 51 and setting 
information area 52 so that the card cannot be reused until the cryptogram 
is applied to secret data area 54. 

In the above embodiment, the voltages "High" are applied to mode 
terminals Te and Tf of read change circuit 61 only when cryptogram 
collating portion 63 issues the matching signal. Thereby, read change 
circuit 61 ignores the data change signal sent from main controller 69. 
Alternatively, the collation mismatching signal may be applied to main 
controller 69, and main controller 69 may determine, based on this, that the 
data change cannot be performed so that the data change signal may not be 
not issued to read change circuit 61. Also, the message to the effect may 
be displayed. 

In this embodiment, the disabling voltage is applied by placing the 
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ground potential on line AG and setting the other lines in the open state. 
However, the voltage is not restricted to the above provided that neither 
writing nor erasing is performed. For example, 0 V may be applied to bit 
line BL for inhibiting the writing, and 0 V may be applied to selected line 
SL for inhibiting the erasing. 

In this embodiment, the state where data "0" is written is the written 
state, the state where data "1" is written is the unwritten state, and the 
data "0" is the written data. However, the state where data "1" is written 
is the written state, and thus the data "1" may be the written data. 

In this embodiment, the state where electrons are injected into the 
floating gate is the state where data "0" is held. Alternatively, the state 
where the electrons are removed from the floating gate may be the state 
where the data "0" is held. 

In this embodiment, if the data "1" is held in the initial state, data 
"0" is set in the bit for reducing the points. Alternatively, data "0" may be 
held in the initial state, and the data "1" may be set in the bit for reducing 
the points. 

In this embodiment, the voltages "Low" are usually applied to mode 
terminals Te and Tf so that only the rewriting for reducing the points in 
point area 51 is allowed, and erasing of the write data is allowed when the 
voltages "High" are applied to mode terminals Te and Tf. Alternatively, 
the voltages "High" may be usually applied to mode terminals Te and Tf, 
and erasing of the write data may be allowed when the voltages "Low" are 
applied to mode terminals Te and Tf. 

In this embodiment, the disabling voltage is provided by placing the 
ground potential on line AG and setting the other lines in the open state. 
However, line AG may be kept at the ground potential. 

In the above embodiment, point area 51 forms, e.g., a point storing 
portion. Main controller 69, address decoder 65 and read change circuit 61 
form, e.g., a read portion. Main controller 69, address decoder 65 and read 
change circuit 61 form, e.g., a point changing portion. Secret data area 53 
forms a point rewrite information storing portion. Cryptogram collating 
portion 63 forms a collating portion. 
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In the above embodiment, the expression to the effect that inhibition 
is performed by the circuit structure means that a specific circuit structure 
is employed for disabling specific processing. More specifically, a logic 
circuit or an electric circuit is used for physically inhibiting specific 
5 processing. 

In this embodiment, the number of the data holding portions in the 
unwritten state ("1") is handled as the remaining points. However, the 
number of the data holding portions in the written state ("0") may be 
handled as the remaining points. Thus, all the data holding portions may 
10 be set to "0" in the all reset state, and "0" may be changed to " 1" in 
accordance with reduction of the points. 

Industrial Applicability 

As described above, the invention can provide the point storing 
15 member of which illegal use is difficult, and therefore can be 

advantageously applied to the fields of manufacturing and selling IC cards. 
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